[PATCH] staging: axis-fifo: fix integer underflow in TX size check

[Maritu Hone]

fifo->tx_fifo_depth is an unsigned int parsed from the devicetree
property "xlnx,tx-fifo-depth" with no lower-bound validation. The
write() packet-size check subtracts 4 from it:

	words_to_write > (fifo->tx_fifo_depth - 4)

If tx_fifo_depth is less than 4, this subtraction underflows and
wraps around to a value near UINT_MAX, so the check that is supposed
to reject oversized writes never triggers, regardless of how large
words_to_write actually is.

Reject the write up front when tx_fifo_depth is below the minimum
required by the hardware, before the subtraction can underflow.

Fixes: 52ff2b840bc7 ("staging: axis-fifo: fix maximum TX packet length check")
Signed-off-by: Maritu Hone <marehone12@xxxxxxxxx>
---
 drivers/staging/axis-fifo/axis-fifo.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/axis-fifo/axis-fifo.c b/drivers/staging/axis-fifo/axis-fifo.c
index 7bb35e11d1dd..aa76be5d78e4 100644
--- a/drivers/staging/axis-fifo/axis-fifo.c
+++ b/drivers/staging/axis-fifo/axis-fifo.c
@@ -228,6 +228,7 @@ static ssize_t axis_fifo_write(struct file *f, const char __user *buf,
 	 * raised, which requires a reset of the TX circuit to recover.
 	 */
 	if (!words_to_write || (len % sizeof(u32)) ||
+	    fifo->tx_fifo_depth < 4 ||
 	    (words_to_write > (fifo->tx_fifo_depth - 4)))
 		return -EINVAL;
 
-- 
2.43.0